Auditing ISO 27001 Annex A 8.20 Network Security is the technical verification of infrastructure hardening and traffic segregation protocols. The Primary Implementation Requirement is the logical separation of network zones and encryption of data in transit, providing the Business Benefit of preventing lateral movement and ensuring secure communications integrity.
ISO 27001 Annex A 8.20 Network Security Audit Checklist
This technical verification tool is designed for lead auditors to establish the security posture of network infrastructure and data in transit. Use this checklist to validate compliance with ISO 27001 Annex A 8.20.
1. Network Security Policy Formalisation Verified
Verification Criteria: A documented policy exists defining the security requirements for network management, including baseline configurations and restricted protocols.
Required Evidence: Approved Network Security Policy or Infrastructure Hardening Standard with explicit version control.
Pass/Fail Test: If the organisation cannot produce a formal policy specifying the mandatory security controls for network equipment, mark as Non-Compliant.
2. Network Segmentation and Segregation Confirmed
Verification Criteria: Technical controls (VLANs, Subnets, or Micro-segmentation) separate the network into logical zones based on sensitivity and function (e.g., DMZ, Corporate, Guest).
Required Evidence: Current network topology diagram and firewall configuration logs showing active traffic isolation between zones.
Pass/Fail Test: If the Guest Wi-Fi or a low-security zone has direct, unfirewalled routing to the production database environment, mark as Non-Compliant.
3. Restricted Use of Insecure Protocols Validated
Verification Criteria: Legacy or insecure protocols (e.g., Telnet, FTP, HTTP, SMBv1) are disabled across all network devices in favour of secure alternatives (SSH, SFTP, HTTPS).
Required Evidence: Port scan results (Nmap) or device configuration exports showing specific port closures.
Pass/Fail Test: If any network management interface is accessible via unencrypted Telnet or HTTP, mark as Non-Compliant.
4. Network Device Hardening Consistency Verified
Verification Criteria: Routers, switches, and firewalls are hardened according to an established baseline, including the removal of default credentials and unused services.
Required Evidence: Hardening checklist sign-offs or configuration comparison reports against CIS Benchmarks.
Pass/Fail Test: If a sampled network switch is found running with factory-default administrative credentials, mark as Non-Compliant.
5. Encryption for Data in Transit Confirmed
Verification Criteria: Technical controls enforce the encryption of data traversing public or untrusted networks using modern protocols (TLS 1.2+ or IPsec VPNs).
Required Evidence: SSL/TLS certificate reports and VPN configuration settings for remote access and site-to-site tunnels.
Pass/Fail Test: If sensitive data is transmitted over the internet via plain-text protocols without a VPN or TLS wrapping, mark as Non-Compliant.
6. Intrusion Detection and Prevention (IDS/IPS) Presence Validated
Verification Criteria: Active monitoring and prevention systems are deployed at network boundaries to detect and block malicious traffic patterns.
Required Evidence: IDS/IPS dashboard screenshots and recent alert logs showing blocked attack signatures.
Pass/Fail Test: If the network perimeter lacks automated detection for common exploit patterns (e.g., SQL injection or brute force), mark as Non-Compliant.
7. Remote Access Security Enforcement Confirmed
Verification Criteria: All remote network access is authenticated via Multi-Factor Authentication (MFA) and restricted to managed or authorised endpoints.
Required Evidence: VPN configuration logs and MFA provider reports showing 100% enforcement for remote users.
Pass/Fail Test: If a user can establish a remote network connection (VPN) using only a single-factor password, mark as Non-Compliant.
8. Firewall Rule Base Integrity Verified
Verification Criteria: Firewall rules follow the “Deny All” principle, with only specifically authorised traffic permitted via the rule base.
Required Evidence: Firewall rule base export showing a “Cleanup” rule (Deny Any/Any) at the bottom of the list.
Pass/Fail Test: If the firewall contains “Any/Any” permit rules or has not undergone a formal rule review in the last 12 months, mark as Non-Compliant.
9. Network Management Tool Access Restricted
Verification Criteria: Access to network management consoles and monitoring tools is restricted to authorised IT personnel using dedicated administrative accounts.
Required Evidence: Access Control Lists (ACLs) for management subnets and RBAC logs from the network management platform.
Pass/Fail Test: If the network management interface (e.g., GUI/SSH) is accessible from the general staff VLAN or Guest network, mark as Non-Compliant.
10. Wireless Network Security Validated
Verification Criteria: Corporate wireless networks use robust authentication (e.g., WPA3 or WPA2-Enterprise with 802.1X) to prevent unauthorised association.
Required Evidence: Wireless Controller (WLC) configuration showing the authentication method and active client certificates.
Pass/Fail Test: If the corporate Wi-Fi relies on a shared Pre-Shared Key (PSK) rather than individual user/device certificates, mark as Non-Compliant.
| Control Requirement | The ‘Checkbox Compliance’ Trap | The Reality Check |
|---|---|---|
| Segmentation | Tool marks “Pass” because a VLAN list is uploaded. | Verify Inter-VLAN Routing. If VLANs exist but the firewall allows all traffic between them, segmentation is a failure. |
| Encryption in Transit | SaaS tool identifies “SSL Certificate” on the website. | Verify Cipher Suites. The auditor must check for support of weak ciphers (e.g., 3DES, RC4) that the tool ignores. |
| Firewall Management | Platform records “Firewall Policy” exists. | Verify Shadow Rules. Automated tools rarely identify rules that are technically active but redundant or insecurely ordered. |
| Remote Access | GRC tool assumes MFA is active on the VPN. | Check Legacy Protocols. Verify that RADIUS or LDAP bypasses haven’t left a “backdoor” for single-factor login. |
| Device Hardening | Tool identifies “Firmware is Up to Date”. | Check Unused Services. A patched router can still have insecure defaults (e.g., SNMP v1/v2 enabled with ‘public’ community strings). |
| IDS/IPS Efficacy | Platform shows the software is “Active”. | Verify Action Mode. Many tools are in “Detection Only” mode. If it doesn’t Prevent, it’s only half a control. |
| Wi-Fi Security | Tool records “WPA2” as the standard. | Verify PSK Rotation. If the organisation uses PSK, when was it last changed? GRC tools never check the password age. |
About the author
